Key takeaways
- 1Global ACI TECH-3-004 (formerly IAF MD 5) is the mandatory document that governs how audit time is determined for management system certification.
- 2Duration begins with the effective number of personnel, and the word doing the work is effective.
- 3From that starting point, defined factors move the duration up or down.
Ask three certification bodies how many days your audit will take and you may get three different answers. Only one question separates a calculation from a guess: what did you base it on?
Audit duration is derived, not offered
Global ACI TECH-3-004 (formerly IAF MD 5) is the mandatory document that governs how audit time is determined for management system certification. It sets a starting point from your organization's size, then defines the factors that may adjust it and the limits on that adjustment.
It exists for a straightforward reason. If audit duration were a commercial variable, competing on price would mean competing on how little looking gets done — and the certificate would stop meaning anything. Fixing the method removes that race.
The starting point: effective number of personnel
Duration begins with the effective number of personnel, and the word doing the work is effective.
It is not the headcount on your payroll system. It includes all personnel involved in the scope: full-time, part-time, temporary, seasonal, contracted staff and shift workers. Part-time and seasonal personnel are converted to an equivalent number rather than counted or ignored.
Two consequences follow, and both surprise people:
A seasonal food producer that runs 40 permanent staff and 200 seasonal workers in harvest does not have an audit sized for 40. And an organization with three shifts is a larger audit than the same headcount on one shift, because the system has to be seen operating on each.
Which is why the honest answer to "how many days will we need?" before knowing shifts and seasonality is: not yet calculable.
What adjusts the number
From that starting point, defined factors move the duration up or down. Broadly:
Complexity of the processes and activities in the scope. Risk associated with the product or service. The number and spread of sites, and whether multi-site sampling applies. Maturity of the management system, and whether it is an integrated audit covering several standards at once. The nature of the audited activity — a design-heavy organization is not a warehouse.
Adjustments are bounded. A certification body cannot reduce duration indefinitely because a client pushed, and the reduction it does apply has to be justified and recorded. That record is examined during accreditation assessment.
Multi-site organizations
Where an organization operates several sites performing similar activities under one management system, Global ACI TECH-3-001 (formerly IAF MD 1) governs whether sampling may be used and how the sample is determined.
Sampling is not a discount. It is a defined method with rules about which sites must always be visited, how many are sampled, and how the sample changes across the certification cycle. Head office is not optional.
Scheme-specific rules
Some schemes add their own layer on top of Global ACI TECH-3-004.
Food safety certification under ISO 22000 is assessed against ISO 22003-1:2022, which brings food-chain categories and its own duration rules. Energy management under ISO 50001 is assessed against ISO 50003:2021, where energy consumption and the number of energy sources enter the calculation directly.
So "how long does an ISO 22000 audit take?" and "how long does an ISO 9001 audit take?" are not the same question, even for the same organization.
What this means when you are comparing quotations
Ask what the day-count was based on. A body that follows the method can tell you: effective personnel, sites, shifts, complexity, scheme.
Give complete information. Understating headcount does not reduce the audit; it produces a plan that does not fit, and the shortfall surfaces on site — usually at the worst moment.
Treat a much lower day-count as a question, not a saving. It may be a legitimate adjustment for a genuinely simpler organization. It may also be a body that priced first and calculated afterwards. The way to find out is to ask how it was derived.
Remember what you are buying. Audit days are the time somebody spends looking. That is the entire product.
CAS — An EGAC accredited MS certification body No. 012418. Send us your effective headcount, sites, shifts and activity, and we will show you the calculation — not just the figure.
Verify any certificate: cas.com.eg/certsearch
Read next